diff options
Diffstat (limited to 'modules')
| -rw-r--r-- | modules/scripts/default.nix | 1 | ||||
| -rw-r--r-- | modules/scripts/gopass-ssh-load/default.nix | 24 | ||||
| -rw-r--r-- | modules/scripts/gopass-ssh-load/script.sh | 33 | ||||
| -rw-r--r-- | modules/security/gopass/default.nix | 51 | ||||
| -rw-r--r-- | modules/security/ssh/default.nix | 2 |
5 files changed, 60 insertions, 51 deletions
diff --git a/modules/scripts/default.nix b/modules/scripts/default.nix index 90b7c9c..2a86ca4 100644 --- a/modules/scripts/default.nix +++ b/modules/scripts/default.nix @@ -6,6 +6,7 @@ { imports = [ ./deep-clean + ./gopass-ssh-load ./neomutt-sync ./screen-recording ./system-monitor diff --git a/modules/scripts/gopass-ssh-load/default.nix b/modules/scripts/gopass-ssh-load/default.nix new file mode 100644 index 0000000..002a4ac --- /dev/null +++ b/modules/scripts/gopass-ssh-load/default.nix @@ -0,0 +1,24 @@ +{ + config, + lib, + pkgs, + ... +}: +let + inherit ((import ../lib.nix { inherit lib pkgs; })) mkScriptModule; + base = mkScriptModule { + name = "gopass-ssh-load"; + path = ./script.sh; + description = "Load SSH keys from gopass password store"; + deps = with pkgs; [ + config.security.gopass.package + gnupg + openssh + ]; + inherit config; + }; +in +{ + options = base.options; + config = base.moduleConfig; +} diff --git a/modules/scripts/gopass-ssh-load/script.sh b/modules/scripts/gopass-ssh-load/script.sh new file mode 100644 index 0000000..e8bc0ee --- /dev/null +++ b/modules/scripts/gopass-ssh-load/script.sh @@ -0,0 +1,33 @@ +export SSH_AUTH_SOCK="$(gpgconf --list-dirs agent-ssh-socket)" + +if [ -z "$SSH_AUTH_SOCK" ] || [ ! -S "$SSH_AUTH_SOCK" ]; then + echo "Error: SSH_AUTH_SOCK is not set or valid." >&2 + exit 1 +fi + +if ssh-add -l 2>/dev/null | grep -qE "(ED25519|RSA|ECDSA)"; then + exit 0 +fi + +for key in github gitlab bitbucket codeberg sourcehut; do + if gopass cat "ssh/$key" > /dev/null 2>&1; then + tmpdir=$(mktemp -d) + keyfile="$tmpdir/key" + gopass cat "ssh/$key" > "$keyfile" 2>/dev/null + chmod 600 "$keyfile" + + if ! ssh-add "$keyfile" 2>/dev/null; then + passphrase=$(gopass cat "ssh/$key/passphrase" 2>/dev/null) + if [ -n "$passphrase" ]; then + tmpcopy=$(mktemp) + cp "$keyfile" "$tmpcopy" + chmod 600 "$tmpcopy" + if ssh-keygen -p -P "$passphrase" -N "" -f "$tmpcopy" 2>/dev/null; then + ssh-add "$tmpcopy" 2>/dev/null + fi + rm -f "$tmpcopy" + fi + fi + rm -rf "$tmpdir" + fi +done diff --git a/modules/security/gopass/default.nix b/modules/security/gopass/default.nix index d6848d8..f9bdf14 100644 --- a/modules/security/gopass/default.nix +++ b/modules/security/gopass/default.nix @@ -5,43 +5,6 @@ pkgs, ... }: -let - gopass-ssh-load = pkgs.writeShellScriptBin "gopass-ssh-load" '' - export SSH_AUTH_SOCK="$(${pkgs.gnupg}/bin/gpgconf --list-dirs agent-ssh-socket)" - - if [ -z "$SSH_AUTH_SOCK" ] || [ ! -S "$SSH_AUTH_SOCK" ]; then - echo "Error: SSH_AUTH_SOCK is not set or valid." >&2 - exit 1 - fi - - if ${pkgs.openssh}/bin/ssh-add -l 2>/dev/null | grep -qE "(ED25519|RSA|ECDSA)"; then - exit 0 - fi - - for key in github gitlab bitbucket codeberg sourcehut; do - if ${config.security.gopass.package}/bin/gopass cat "ssh/$key" > /dev/null 2>&1; then - tmpdir=$(mktemp -d) - keyfile="$tmpdir/key" - ${config.security.gopass.package}/bin/gopass cat "ssh/$key" > "$keyfile" 2>/dev/null - chmod 600 "$keyfile" - - if ! ${pkgs.openssh}/bin/ssh-add "$keyfile" 2>/dev/null; then - passphrase=$(${config.security.gopass.package}/bin/gopass cat "ssh/$key/passphrase" 2>/dev/null) - if [ -n "$passphrase" ]; then - tmpcopy=$(mktemp) - cp "$keyfile" "$tmpcopy" - chmod 600 "$tmpcopy" - if ${pkgs.openssh}/bin/ssh-keygen -p -P "$passphrase" -N "" -f "$tmpcopy" 2>/dev/null; then - ${pkgs.openssh}/bin/ssh-add "$tmpcopy" 2>/dev/null - fi - rm -f "$tmpcopy" - fi - fi - rm -rf "$tmpdir" - fi - done - ''; -in { options.security.gopass = { enable = lib.mkEnableOption "Enables gopass."; @@ -51,18 +14,10 @@ in defaultText = lib.literalExpression "pkgs.gopass.override { passAlias = true; }"; description = "The gopass package to use."; }; - ssh-agent = { - enable = lib.mkEnableOption "gopass-backed SSH keys for git"; - script = lib.mkOption { - type = lib.types.package; - description = "The package containing the gopass-ssh-load script."; - }; - }; + ssh-agent.enable = lib.mkEnableOption "gopass-backed SSH keys for git"; }; config = lib.mkIf config.security.gopass.enable { - security.gopass.ssh-agent.script = gopass-ssh-load; - programs.password-store = { enable = true; package = config.security.gopass.package; @@ -74,9 +29,5 @@ in home.sessionVariables = { PASSWORD_STORE_DIR = config.programs.password-store.settings.PASSWORD_STORE_DIR; }; - - home.packages = lib.mkIf config.security.gopass.ssh-agent.enable [ - config.security.gopass.ssh-agent.script - ]; }; } diff --git a/modules/security/ssh/default.nix b/modules/security/ssh/default.nix index 62186c4..f9e56bd 100644 --- a/modules/security/ssh/default.nix +++ b/modules/security/ssh/default.nix @@ -24,7 +24,7 @@ buildInputs = [ pkgs.makeWrapper ]; postBuild = '' wrapProgram $out/bin/ssh \ - --run "${config.security.gopass.ssh-agent.script}/bin/gopass-ssh-load" + --run "${lib.getExe config.scripts.gopass-ssh-load.package}" ''; } else |